AWS S3 Control

2018/11/15 - AWS S3 Control - 3 new api methods

Changes  Add support for new S3 Block Public Access bucket-level APIs. The new Block Public Access settings allow bucket owners to prevent public access to S3 data via bucket/object ACLs or bucket policies.

DeletePublicAccessBlock (new) Link ¶

Removes the Public Access Block configuration for an Amazon Web Services account.

See also: AWS API Documentation

Request Syntax

client.delete_public_access_block(
    AccountId='string'
)
type AccountId

string

param AccountId

[REQUIRED]

The Account ID for the Amazon Web Services account whose Public Access Block configuration you want to remove.

returns

None

PutPublicAccessBlock (new) Link ¶

Creates or modifies the Public Access Block configuration for an Amazon Web Services account.

See also: AWS API Documentation

Request Syntax

client.put_public_access_block(
    PublicAccessBlockConfiguration={
        'BlockPublicAcls': True|False,
        'IgnorePublicAcls': True|False,
        'BlockPublicPolicy': True|False,
        'RestrictPublicBuckets': True|False
    },
    AccountId='string'
)
type PublicAccessBlockConfiguration

dict

param PublicAccessBlockConfiguration

[REQUIRED]

The Public Access Block configuration that you want to apply to this Amazon Web Services account.

  • BlockPublicAcls (boolean) --

    Specifies whether Amazon S3 should block public ACLs for buckets in this account. Setting this element to TRUE causes the following behavior:

    • PUT Bucket acl and PUT Object acl calls will fail if the specified ACL allows public access.

    • PUT Object calls will fail if the request includes an object ACL.

    Note that enabling this setting doesn't affect existing policies or ACLs.

  • IgnorePublicAcls (boolean) --

    Specifies whether Amazon S3 should ignore public ACLs for buckets in this account. Setting this element to TRUE causes Amazon S3 to ignore all public ACLs on buckets in this account and any objects that they contain.

    Note that enabling this setting doesn't affect the persistence of any existing ACLs and doesn't prevent new public ACLs from being set.

  • BlockPublicPolicy (boolean) --

    Specifies whether Amazon S3 should block public bucket policies for buckets in this account. Setting this element to TRUE causes Amazon S3 to reject calls to PUT Bucket policy if the specified bucket policy allows public access.

    Note that enabling this setting doesn't affect existing bucket policies.

  • RestrictPublicBuckets (boolean) --

    Specifies whether Amazon S3 should restrict public bucket policies for buckets in this account. If this element is set to TRUE , then only the bucket owner and AWS Services can access buckets with public policies.

    Note that enabling this setting doesn't affect previously stored bucket policies, except that public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked.

type AccountId

string

param AccountId

[REQUIRED]

The Account ID for the Amazon Web Services account whose Public Access Block configuration you want to set.

returns

None

GetPublicAccessBlock (new) Link ¶

Retrieves the Public Access Block configuration for an Amazon Web Services account.

See also: AWS API Documentation

Request Syntax

client.get_public_access_block(
    AccountId='string'
)
type AccountId

string

param AccountId

[REQUIRED]

The Account ID for the Amazon Web Services account whose Public Access Block configuration you want to retrieve.

rtype

dict

returns

Response Syntax

{
    'PublicAccessBlockConfiguration': {
        'BlockPublicAcls': True|False,
        'IgnorePublicAcls': True|False,
        'BlockPublicPolicy': True|False,
        'RestrictPublicBuckets': True|False
    }
}

Response Structure

  • (dict) --

    • PublicAccessBlockConfiguration (dict) --

      The Public Access Block configuration currently in effect for this Amazon Web Services account.

      • BlockPublicAcls (boolean) --

        Specifies whether Amazon S3 should block public ACLs for buckets in this account. Setting this element to TRUE causes the following behavior:

        • PUT Bucket acl and PUT Object acl calls will fail if the specified ACL allows public access.

        • PUT Object calls will fail if the request includes an object ACL.

        Note that enabling this setting doesn't affect existing policies or ACLs.

      • IgnorePublicAcls (boolean) --

        Specifies whether Amazon S3 should ignore public ACLs for buckets in this account. Setting this element to TRUE causes Amazon S3 to ignore all public ACLs on buckets in this account and any objects that they contain.

        Note that enabling this setting doesn't affect the persistence of any existing ACLs and doesn't prevent new public ACLs from being set.

      • BlockPublicPolicy (boolean) --

        Specifies whether Amazon S3 should block public bucket policies for buckets in this account. Setting this element to TRUE causes Amazon S3 to reject calls to PUT Bucket policy if the specified bucket policy allows public access.

        Note that enabling this setting doesn't affect existing bucket policies.

      • RestrictPublicBuckets (boolean) --

        Specifies whether Amazon S3 should restrict public bucket policies for buckets in this account. If this element is set to TRUE , then only the bucket owner and AWS Services can access buckets with public policies.

        Note that enabling this setting doesn't affect previously stored bucket policies, except that public and cross-account access within any public bucket policy, including non-public delegation to specific accounts, is blocked.